GCC regulators have moved from observation to enforcement on buy now, pay later. Within the space of eighteen months, three central banks have published binding frameworks that will reshape how BNPL products are structured, priced, and distributed across the region's fastest-growing consumer credit segment. For payments firms, fintechs, and the merchants that embed deferred payment options at checkout, the window for unhurried compliance planning has closed.
The Scale of the Opportunity and the Regulatory Trigger
The GCC BNPL market was valued at approximately USD 4.9 billion in 2024 and is projected to reach USD 15 billion by 2028, driven by high smartphone penetration, a young unbanked or underbanked population, and merchant appetite for conversion uplift at the point of sale. Saudi Arabia and the UAE together account for the majority of transaction volume, with Qatar growing rapidly off a smaller base. That trajectory attracted regulatory attention not because growth itself is problematic, but because the product had been operating in a structural gap: it was generating consumer credit exposure without the affordability checks, licensing obligations, or conduct rules that apply to conventional personal finance.
The catalyst for coordinated action was a set of shared concerns across the three central banks: rising household indebtedness, opaque fee structures embedded in merchant discount rates and passed on implicitly to consumers, and the absence of any obligation on BNPL providers to report to credit bureaux. The result is three distinct but philosophically aligned frameworks, each with its own licensing architecture and timetable.
Saudi Arabia: SAMA's BNPL Licensing Regime
The Saudi Central Bank (SAMA) published its Buy Now Pay Later regulatory framework in 2022 and has since moved through successive implementation phases. Under the framework, any entity offering deferred payment products to Saudi consumers must hold a Finance Company Licence or operate under an existing licensed finance company as a regulated agent. The rules require providers to conduct affordability assessments before extending any instalment facility, apply a cap on the number of concurrent BNPL agreements a single consumer may hold, and integrate with the Saudi Credit Bureau (SIMAH) for both data reporting and pre-approval enquiries.
SAMA's framework also introduces product-level transparency obligations. Providers must disclose the total cost of the transaction in Saudi Riyals, including any fee that would be triggered by a missed instalment, before the consumer confirms purchase. Late payment fees are subject to a regulatory ceiling, and providers are prohibited from rolling a missed instalment into a new facility without explicit consumer consent and a fresh affordability check. As of Q1 2026, SAMA had granted licences to a number of dedicated BNPL operators, including Tamara and Tabby, while also publishing guidance on the obligations that fall on merchants integrating these services through their payment acceptance infrastructure.
UAE: The CBUAE's Payment Token and Consumer Finance Intersection
The Central Bank of the UAE (CBUAE) has approached BNPL regulation through two interlocking instruments. The first is the Retail Payment Services and Card Schemes Regulation (RPSCS), which classifies certain BNPL arrangements as a regulated retail payment service requiring a licence under the central bank's payments framework. The second is the broader Consumer Protection Regulation, which applies conduct obligations to all licensed financial service providers, including those offering instalment products.
From a practical standpoint, BNPL providers operating in the UAE must hold a Stored Value Facility (SVF) licence or a Retail Payment Service licence, depending on how the product is structured. Providers that extend credit beyond a defined threshold are additionally required to comply with the CBUAE's finance company requirements, which include capital adequacy ratios, governance standards, and submission of regular statistical returns. The CBUAE has indicated that it will introduce formal BNPL-specific prudential guidance in 2026, building on the framework already in place. Critically, the UAE's Al Etihad Credit Bureau (AECB) integration requirement means that consumer BNPL exposure is now visible to other lenders for the first time, materially changing the risk profile of the product for both providers and their funding counterparties.
Qatar: QCB's Proportionate Framework
The Qatar Central Bank (QCB) published its BNPL regulatory instructions in 2023, requiring all providers to register with the central bank and comply with a conduct framework that mirrors several of the SAMA principles. The QCB framework mandates that BNPL providers undertake a creditworthiness assessment for each consumer, limits the maximum instalment period to twelve months for unregulated credit providers (longer tenors requiring a full consumer finance licence), and requires clear disclosure of all charges at the point of offer. Qatar's relatively smaller consumer market means the regulatory burden is calibrated accordingly, but the QCB has been explicit that non-registered providers operating within Qatari jurisdiction are subject to enforcement action regardless of where they are incorporated.
What the Frameworks Mean in Practice for Payments Firms
The three frameworks share a common architecture even where they differ in detail. Licensing is mandatory. Affordability and creditworthiness assessment is mandatory. Credit bureau integration is mandatory or imminent in all three jurisdictions. Fee transparency at the point of sale is mandatory. The informal operating model, under which a BNPL provider structured its product as a merchant service rather than a consumer credit product to avoid regulatory classification, is no longer viable across any of the three major GCC markets.
For payment service providers (PSPs) and acquirers that distribute BNPL as a checkout option, the critical question is whether they have assessed their own obligations under the new frameworks. Merchant agreements that embed BNPL without explicit reference to the regulatory status of the BNPL provider create potential exposure for the acquirer, particularly under conduct and consumer protection provisions that look to the entire payment chain.
Actions for Payments Firms Now
Firms should treat the following as immediate priorities rather than items for the next planning cycle. First, conduct a jurisdictional mapping of every BNPL product or partnership that touches a GCC consumer, regardless of where the contractual relationship is booked. Second, audit merchant agreements and checkout integration documentation to confirm that the BNPL provider in each arrangement holds the relevant licence in each jurisdiction where it operates. Third, engage legal counsel on the CBUAE's forthcoming 2026 prudential guidance, which is expected to introduce capital and liquidity requirements that will affect the funding structures of smaller operators. Fourth, review credit bureau integration workflows: if your platform is not yet submitting BNPL data to SIMAH, AECB, or the QCB's designated bureau, that is a compliance gap with an active enforcement risk attached. Fifth, brief the board and relevant executive committees on the change in risk profile. BNPL is no longer a fintech adjacency; it is a regulated consumer credit product in the GCC, and the governance frameworks of payments firms should reflect that reality now.